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Security bounds for key distribution protocols using coherent and squeezed states and homodyne 
measurements are presented. These bounds refer to (i) general attacks and (ii) collective attacks 
where Eve interacts individually with the sent states, but delays her measurement until the end of 
the reconciliation process. For the case of a lossy line and coherent states, it is first proven that 
a secure key distribution is possible up to 1.9 dB of losses. For the second scenario, the security 
bounds are the same as for the completely incoherent attack. 



PACS numbers: 03.67.Dd, 03.65.Ud, 03.67.-a 

Quantum Cryptography, that is quantum key distribu- 
tion (QKD) followed by one-time pad, allows two honest 
parties to interchange private information in a completely 
secure way. Quantum states sent through an insecure 
channel are used to establish correlations between the 
sender, Alice, and the receiver. Bob. Since the channel 
is not secure, the eavesdropper. Eve, can interact with 
the sent states. However, the no-cloning theorem 'Tj lim- 
its her action: she cannot produce and keep a perfect 
copy of the intercepted quantum state. After this corre- 
lation distribution, Alice and Bob employ reconciliation 
techniques in order to distill from their list of classical 
symbols, perfectly correlated and completely random bits 
about which Eve has no information, that is a secret key. 
This key is later consumed for sending private informa- 
tion by means of the one-time pad. 

The first QKD protocol was introduced by Bennett 
and Brassard in 1984 and uses two-dimensional quan- 
tum systems, or qubits, as information carriers. Af- 
ter it, other QKD protocols were presented using 
finite-dimensional systems as well. More recently, it has 
been shown that protocols based on continuous variables 
quantum systems could offer an alternative to finite- 
dimensional schemes. The first of these protocols em- 
ployed squeezed states of light and homodyne measure- 
ments |j,|5|. Later, a QKD protocol using coherent states 
and homodyne measurements was proposed in 6] and ex- 
perimentally demonstrated in 

The security of continuous variables QKD protocols 
against any type of attack has already been proven, both 
for the squeezed and coherent case. The bounds 
derived in these works provide sufficient conditions for 
a secure key distribution. There also exist restricted se- 
curity proofs (see for instance 0, IE 0) where Eve is 
assumed to apply an incoherent attack, that is (i) she in- 
teracts with the sent states individually and in the same 
way and (ii) performs incoherent measurements before 
the reconciliation process has started. The correspond- 
ing bounds, then, can be seen as necessary conditions for 
a secure key distribution |inl | . Unfortunately, there exists 
a clear gap between the security conditions for general 
and individual attacks, and we are far from establishing 



necessary and sufficient conditions for security. 

In this work, we analyze the security of QKD proto- 
cols employing coherent or squeezed states and homo- 
dyne measurements. Using the techniques developed in 
Refs. [nlElEi, we find new security bounds for these 
schemes in the two following scenarios: first, we impose 
no assumption on Eve's attack and derive a simple con- 
dition for general security. Later, we assume that Eve 
applies to the sent states the optimal individual inter- 
action, but, contrary to previous proofs, she delays her 
measurement until the end of the reconciliation process. 
This type of attacks is sometimes called collective. In this 
second scenario, and for the case of a lossy line, we show 
that the limits for key distillation coincide with those 
found for incoherent attacks. To our knowledge, this is 
the first situation in which it is proven that to let Eve 
delay her measurement until the end of the reconciliation 
process does not modifiy the security region. 

By completing this work, we learn that similar results 
have independently been obtained by Grosshans p^ . 

QKD protocols: In all the considered protocols, Al- 
ice sends to Bob squeezed or coherent states of light 
modulated by a Gaussian probability distribution. These 
states propagate through a quantum channel character- 
ized by its transmission T and excess noise e. Bob ran- 
domly measures one of two quadratures, X or P, and 
communicates the chosen measurement to Alice. Alice 
and Bob obtain a list of correlated real numbers from 
which the key has to be extracted. There exists an 
entanglement-based protocol that is completely equiva- 
lent to this prepare and measure (P&M) scheme [l^]. In- 
deed, Alice's preparation can be done by measuring half 
of a two- mode squeezed state, of squeezing parameter r^, 
as shown in Fig. ^ For instance, Alice can measure both 
quadratures, Xa and Pa, after the beam-splitter of trans- 
mittivity Ta = 1/2. The corresponding P&M scheme 
consists of Alice sending coherent states with a Gaussian 
probability distributions of variance < X"^ >=< P^ >= 
(cosh(r) - l)/2. On the other hand, if Ta = 1 and Al- 
ice chooses randomly the measured quadrature, she is 
effectively sending squeezed states of squeezing parame- 
ter cosh(r) and modulated with a Gaussian distribution 
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FIG. 1: The picture shows the considered protocols. After 
Alice's effective preparation using an entangled state, coher- 
ent or squeezed states of light are sent to Bob, according to 
a Gaussian modulation. Eve replaces the channel by the en- 
tangling doner of parameters te and Te- 



of variance < >= sinh(r)^/(2 cosh(r)). This entan- 
glement description simplifies the theoretical analysis of 
the protocols, but the obtained security bounds automat- 
ically apply to the corresponding P&M scheme. 

It is also convenient at this point to introduce Eve's op- 
timal individual attack, the so-called entangling doner. 
As proven in |^ H^ . the optimal way in which Eve 
can "simulate" the channel (T, e) is by combining into 
a beam-splitter of transmittivity Te = 1 — T, the in- 
tercepted state and half of a two-mode squeezed state. 
The squeezing parameter, te, has to be chosen such that 
(l-T)coshr£; = l-T + eT. 

General security proof: Recently, powerful techniques 
for the analysis of general securi ty p roofs of any QKD 
protocol have been presented in . In any QKD 
scheme, there is a tomographic process that partly char- 
acterizes the insecure channel connecting Alice and Bob. 
It allows the honest parties to evaluate their mutual infor- 
mation, Iab- Moreover, it puts a bound on Eve's knowl- 
edge: it has been shown in that, using the informa- 
tion collected during this process, one can construct a 
secure reconciliation protocol that allows to extract 



K = Iab - max S{pab), 



(1) 



secret bits, where TZ is the set of quantum states consis- 
tent with the measured probabilities (see for more 
details). Thus, this quantity represents a lower bound to 
the achievable key rate, Kopt > K- For continuous vari- 
able systems, if Alice and Bob monitor the channel by 
means of the first and second moments of their data, the 
state pab of maximal entropy in has to be Gaussian 
[l7j . This is indeed the case for the attack in Fig. ^ 

A simple calculation shows that for the same measured 
quadrature, the joint probability distribution of Alice and 



Bob's results is Gaussian with covariance matrix 

Ta cosh rA + Ra ^TaT sinh ta 
\/TaT sinh ta T cosh rA~\-R cosh r e 



(2) 



where R = \ — T and the same for Ra- This gives the 
first term in . The second term can be computed from 
PEj since S[pab) = S{pe)- Eve's state is a two-mode 
Gaussian state, with covariance matrix ^e = "/'e^'^' 
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(3) 



Using and (O, it is straightforward to compute K as 
a function oi TatTAtT^e. 

For the case of a lossy line, e = 0, one can numerically 



see that there exists an optimal squeezing for both 
the coherent and squeezed case (see Fig. A possible 
reason for this counter-intuitive result may be that K is 
known to be a non-tight bound to the optimal key rate 
. This optimal squeezing is the same for squeezed and 



coherent states, 



opt 



1.5, and defines a critical value for 



the tolerable losses of approximately 1.7 and 0.83 dB. 
As discussed in it is possible to improve the bound 
by conditioning the privacy amplification process on 
a classical random variable W (see [ll| for more details) , 
decreasing Eve's entropy. For the case of coherent states, 
Alice and Bob can make public the value of the second 
measured quadrature, instead of discarding it This 
process does not modify Alice and Bob's mutual infor- 
mation but changes Eve's entropy. The obtained criti- 
cal transmission, Tc, is now a decreasing function of the 
squeezing, as expected. One can see that in the limit of 
high modulation, ta^oo, 



(4) 



That is, the protocol using coherent states and homodyne 
measurements is secure up to 1.9 dB of losses. 

Collective attack: As said above, the bound ^ is 
very useful because it does not make any assumption on 
Eve's attack, but is known not to be tight. Moreover, it 
doesn't allow to distinguish between direct and reverse 
reconciliation protocols, where the (one-way) flow of in- 
formation goes from Alice to Bob and viceversa. This 
distinction doesn't play any role in QKD protocol using 
finite-dimensional quantum systems, but is relevant for 
continuous variables protocols Indeed, for the case 
of a lossy line and incoherent attacks, the value of the 
channel transmission limiting the security is equal to 1/2 
for direct reconciliation, while it goes to zero for reverse 
reconciliation, for squeezed and coherent states Q. 

In what follows, we will consider an attack where the 
only assumption is that Eve applies to the intercepted 
states the optimal individual interaction. In the entan- 
glement picture, this corresponds to the case where Alice, 
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FIG. 2: Tolerable losses as a function of the modulation for 
protocols using coherent (solid line) and squeezed (dashed 
line) states. The optimal value for both schemes is ta ~ 1-5. 



Bob and Eve share N independent realizations of a quan- 
tum state \^abe)- This scenario is again represented 
in Fig. ^ However, contrary to the usual incoherent 
attacks previously studied, Eve delays her measurement 
until the end of the reconciliation protocol. Note that this 
attack is clearly coherent, because Eve can globally mea- 
sure her N quantum states. Moreover, she can optimize 
her measurement according to all the communication in- 
terchanged during the whole reconciliation process. 

After Alice and Bob's measurements, the three parties 
share TV independent realizations of classical-classical- 
quantum (ccq) correlated variables A, B and {tPe)- Un- 
der the N independent realizations assumption, it has 
been shown in [l^ that there exists a key distillation 



protocol achieving a rate 

K' = Iab ~ X{A : E), 



(5) 



where x denotes the Holevo bound 19] . This security 
condition is rather intuitive: if this quantity is positive, 
the information Bob has on Alice's symbols is larger than 
the classical information accessible to Eve through the 
quantum channel Alice-Eve. The results of |12| prove 
that this advantage can indeed be exploited for distilling 
a key. Moreover they can be seen as the generalization of 
the results of [l3| . where Bob's information was quantum 
(cqq). When considering reverse reconciliation, a similar 
expression holds where ■ E) is replaced by x{B : E). 

For a lossy line and direct reconciliation, the critical 
transmission, Tc, limiting the security is again a decreas- 
ing function of the squeezing r^. In the limit of very 
high modulation one can see that Tc is the solution to 
the equation 



Tcil-Tc)il-Tc + TA{2Tc-l)) 
Ta + Tc- 2TaTc 



Remarkably, Tc = 1/2 is the searched solution VTa, i.e. 
we recover the same value as for the completely incoher- 
ent attack 1^. Therefore, by increasing the modulation 
rA, the limiting losses value for a key distribution secure 
against collective attacks tends to 3 dB. 

A stronger result is obtained for reverse reconciliation. 
When T and also ta are small, the key rate lO goes as 



K' w TAT{coshrA - 1) 



(7) 



Therefore, there is no loss limit for reverse reconcilia- 
tion protocols. But perhaps more surprisingly, there is 
no need of high modulation or squeezing for recovering 
the same limits as for the completely incoherent attack! 
That is, a protocol using coherent states and any mod- 
ulation is secure for all line transmissions, even if Eve is 
assumed to delay her measurement until the end of the 
whole reconciliation process. 

Concerning the amount of excess noise the protocols 
tolerate, this is shown in Fig. Q. For squeezed states, 
it is always more convenient to employ reverse reconcili- 
ation techniques. For the case of coherent states, direct 
reconciliation turns out to be more resistant against ex- 
cess noise up to a channel transmission of « 0.65. Note 
that there exist limiting values of the excess noise, Ec, for 
which the considered key rates are zero, independently of 
the modulation and the losses. These values can be com- 
puted analytically. For coherent states and direct recon- 
ciliation, one has that Sc is the solution to the equation 



i + s vyrTe- 1, 

that gives £c ~ 0.8, while for reverse reconciliation 

0.39. 




(1 - Tc 



(6) 



(8) 



(9) 



In the case of squeezed states, the critical noise is equal 
to 2/e « 0.7 for both reconciliation protocols. 

Concluding remarks: In this work we have applied the 
recent security proofs of Refs. [ilElE3 to QKD pro- 
tocols using coherent and squeezed states and homodyne 
measurement. It has to be clear that the obtained re- 
sults provide lower bounds to the achievable secret key 
rate. Thus, they represent sufficient conditions for key 
distillation for the studied scenario (and assumptions). 

The first of the analyzed conditions is very powerful 
because does not make any assumption on the eaves- 
dropping attack. For a lossy line and coherent states, 
it has been shown here that a secure key distribution is 
possible up to 1.9 dB of losses. Existing proofs of secu- 
rity work up to 1.4 and 1.6 dB of losses. Thus, 
our results slightly improve the known region of general 
security, without requiring any squeezing. 
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FIG. 3: Tolerable excess noise as a function of the losses for 
reverse and direct reconciliation and squeezed (dashed line) 
and coherent (solid line) states. All the curves have been 
computed in the limit of very high modulation, ta —> oo. 

The second type of bounds does not refer to the most 
general situation, since AHce, Bob and Eve are assumed 
to share N linearly independent copies of a quantum 
state I'^fABs)- Consequently, we have considered the 
case where Eve applies the optimal individual interac- 
tion [isl to any sent state. Therefore, in this first 
step of her attack. Eve is assumed to introduce no correla- 
tions among the quantum states shared by Alice and Bob. 
The bounds obtained in this scenario cannot be seen as 
proofs of general security. However, it is now possible 
to distinguish between direct and reverse reconciliation, 
a relevant issue for continuous variables quantum cryp- 
tography. Remarkably, the obtained bounds turn out to 
be the same as for the fully incoherent attack. The case 
of reverse reconciliation is perhaps more surprising, since 
this is true for any value of Alice's modulation. As far as 
we know, this is the first situation in which it is proven 
that allowing Eve to delay her measurement does not give 
her any significant advantage (see also [l^lioj ). 

We would like to conclude with a brief comment on 
the N independent copies assumption required for the 
bound |SJl. According to our results, the only possibility 
left to Eve that could modify the security bounds for the 
fully incoherent attack would be to introduce correlations 
among the different copies of the states. Does this fact 
provide any improvement on her attack? As discussed in 
what follows, one could expect this not to be the case. 
After some channel tomography, Alice and Bob know to 
share a state p^^^ such that any single copy is a state 
Pab G Ti-, consistent with their measured probabilities. 
They should assume that Eve has tried to be as corre- 
lated as possible to their state. Since the global state 
is pure, this means that Eve has optimized the entangle- 
ment of 1^^^^;) over the splitting AB~E. Thus, she has 



maximized the entropy of entanglement |2l| of \^ abe)^ 
i.e. the entropy of the local state subject to the 

constraint that the single-copy state is pab- This max- 
imization naturally leads to the N independent copies 
assumptions, since S'(p^'') < N S{pab) = Sip'lg). Al- 
though far from being a proof, this simple argument, as 
well as Eq. suggests that the best attack could con- 
sist of Eve preparing N copies of the most entropic state. 
If this was true, the bounds derived from would hold 
and provide a necessary and sufhcient condition for a se- 
cure QKD over a lossy line using coherent (or squeezed) 
states and homodyne measurements. 
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